Microsoft Entra ID Security Updates: Key 2026 Changes

Introduction

Microsoft is tightening Microsoft Entra ID security in several areas that directly affect authentication, Conditional Access, and self-service password reset. For IT admins, these changes are important because they remove legacy behavior, close enforcement gaps, and require preparation ahead of hard deadlines in 2026.

What’s new in Microsoft Entra ID

1. Custom controls are being deprecated

Microsoft is retiring Custom controls and steering organizations to External MFA for third-party MFA integrations in Conditional Access.

• Existing Custom controls will keep working during the transition period
• Retirement date: September 30, 2026
• End of life: May 2027
• External MFA offers deeper integration and a more modern, standards-based approach

If your organization still relies on Custom controls, migration planning should start now.

2. Conditional Access will apply consistently during credential registration

Starting the week of July 6, 2026, Conditional Access policies targeting the Register security information action will also apply to:

• Windows Hello for Business provisioning
• macOS Platform Single Sign-on registration

This closes a long-standing gap where some registration experiences were not governed by the same Conditional Access rules used elsewhere. Users who do not meet policy requirements may see additional prompts during setup or registration.

3. SSPR will require registered authentication methods

Microsoft is changing self-service password reset (SSPR) so only explicitly registered authentication methods can be used.

• Registration campaign starts: July 6, 2026
• Enforcement begins: September 7, 2026
• Directory-based phone numbers or email addresses that were never formally registered will no longer work for SSPR verification

This aligns password reset with stronger proof-of-possession and user-verified authentication methods.

Impact on IT administrators

These changes could affect onboarding, device setup, password reset success rates, and third-party MFA integrations. Organizations that do not prepare may see user friction, help desk volume increases, or unsupported legacy configurations as enforcement dates approach.

What admins should do now

• Inventory any Custom controls dependencies
• Review External MFA migration requirements
• Test registration-related Conditional Access policies in report-only mode
• Validate Windows Hello for Business and macOS registration scenarios
• Audit SSPR readiness and identify users relying on unregistered directory values
• Communicate upcoming registration prompts and deadlines to users and support teams

The main takeaway: review your Entra ID authentication and access policies now so these 2026 security changes do not disrupt users later.